# Update a key

`PATCH /api/api-keys/{id}`  (operationId: `updateApiKey`, group: API keys)

Rename a key, or change its expiry or rate limit. Send null for expires_at or rate_limit_per_min to clear them. Scopes cannot be changed: rotate the key instead, so an old secret can never quietly become more powerful.

Part of the full API, which is included in the Scale plan. Workspace admin: a dashboard session, or a full-access key created by an admin. A scoped key is refused with scope_denied.

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | integer | yes | Key id. |

**Request body** (JSON, required)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `label` | string | no |  |
| `expires_in_days` | integer, nullable | no |  |
| `expires_at` | string (date-time), nullable | no |  |
| `rate_limit_per_min` | integer, nullable | no |  |

Example:

```json
{
  "label": "Dashboard (prod)",
  "rate_limit_per_min": 300
}
```

**Response 200**: Updated.

Example:

```json
{
  "success": true
}
```

**Errors specific to this call.** The common ones (401, 403, 429 and the rest) are in the [Errors guide](https://inboxwa.online/docs/api/guide/errors.md).

| Status | error | When |
| --- | --- | --- |
| 400 | `nothing_to_update` | The body changed nothing. |
| 404 | `not_found` | No such key in this workspace. |
| 400 | `already_revoked` | The key is revoked. |

Part of the InboxWA API reference: https://inboxwa.online/docs/api . Full reference as one document: https://inboxwa.online/docs/api.md . OpenAPI: https://inboxwa.online/openapi.json